The registry and the ecosystem, honestly

Lesson 5 of 5 in MCP Fundamentals: One Protocol Instead of M × N Integrations.

A protocol is only as useful as the things that speak it, so finish with the state of the ecosystem — dated, sourced, and without the boosterism that usually attaches to this topic.

Start with the piece people most often misunderstand: the MCP Registry.

It hosts metadata, not code

The registry stores a standardized server.json per server: the unique reverse-DNS name (e.g. io.github.user/server-name), the package or remote location, execution instructions, and discovery data. The actual packages live in npm, PyPI, and Docker Hub, or behind a remote server URL.

Consequence for your threat model: “it is in the official registry” tells you where to find a server, not what its code does. The supply-chain risk stays where the artifact is.

Namespaces are authenticated; security scanning is delegated

Server names are reverse-DNS and tied to verified GitHub accounts or domains, via GitHub, DNS, or HTTP challenges — so only the legitimate owner can publish under a namespace. That is real, and it kills a whole class of impersonation.

What it is not: a security review. Security scanning is delegated to the package registries and to downstream aggregators, and registry maintainers can manually remove spam or malicious servers per the moderation policy. Namespace ownership authenticates who published, not what they published.

It is built for aggregators, not for your host app

The official registry is intended to be consumed primarily by downstream aggregators — MCP marketplaces and the like — rather than directly by host applications, and its metadata is deliberately unopinionated. Curation, ratings, and trust signals are the aggregators’ job.

It publishes an OpenAPI spec so other registries, including private internal ones, can implement the same interface. The codebase is not designed for self-hosting, and private servers are not supported in the official registry. If your company wants a curated internal catalogue, the standardized interface — not the public registry — is the thing to reuse.

Governance is the second thing worth getting precisely right, because the loose version of the story is wrong in both directions.

MCP was created at Anthropic by David Soria Parra and Justin Spahr-Summers, and announced and open-sourced on 25 November 2024 along with the spec, the SDKs, local server support in the Claude Desktop apps, and a repository of pre-built servers — Google Drive, Slack, GitHub, Git, Postgres, Puppeteer — with Block and Apollo as early integrators. On 9 December 2025, Anthropic announced it was donating MCP to the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI, with support from Google, Microsoft, AWS, Cloudflare and Bloomberg. MCP is a founding project there alongside goose and AGENTS.md. The project entity is “Model Context Protocol a Series of LF Projects, LLC”.

Say it precisely

Two sloppy claims to avoid, both common: MCP is not “owned by Anthropic” today, and it was not “donated to the Linux Foundation” directly — it went to the AAIF, a directed fund under the Linux Foundation, and the announcement stressed that the Linux Foundation “will not dictate the technical direction of MCP” and that “for MCP little changes. The governance model we introduced earlier this year continues as is.”

Technical governance is a hierarchy modelled on Python and PyTorch: Lead Maintainers (BDFL, final authority) → Core Maintainers → Maintainers → Contributors, together the MCP Steering Group. Membership is individual, with no seats reserved for specific companies. As of 2026-09-13 the Lead Maintainers are David Soria Parra and Den Delimarsky, with Justin Spahr-Summers listed as Co-Inventor and Lead Maintainer Emeritus — names that can change, so check the governance page.

Spec changes go through Specification Enhancement Proposals (SEPs), organised by Working Groups and Interest Groups. You have already met three: SEP-2322 (MRTR), SEP-2577 (sampling and roots deprecation), SEP-2596 (feature lifecycle policy). When you want to know why the protocol changed, the SEP is the document to read.

How MCP got here

2024-11-05 — MCP specification revision 2024-11-05:
The first protocol revision: the initialize handshake, stdio and HTTP+SSE transports, and the three primitives — tools, resources, prompts. It is now marked Final, and everything later in the MCP story is a revision to this shape.
2024-11-25 — Anthropic open-sources the Model Context Protocol:
Spec, SDKs, local server support in Claude Desktop, and a repository of pre-built servers (Google Drive, Slack, GitHub, Git, Postgres, Puppeteer) shipped together, with Block, Apollo, Zed, Replit, Codeium, and Sourcegraph named as early adopters. Write the integration once, and any compliant client can use it — the reason the industry converged on it within a year.
2025-03-26 — MCP 2025-03-26: OAuth authorization and Streamable HTTP:
The revision that made MCP deployable over the network: an authorization framework built on OAuth 2.1 (still an IETF draft, not a published RFC), Streamable HTTP replacing HTTP+SSE, plus tool annotations and audio content. HTTP+SSE is deprecated from here — deprecated, not removed.
2025-06-18 — MCP 2025-06-18: elicitation, structured output, resource-server model:
JSON-RPC batching came out; elicitation (the server asking the user for input mid-call), structured tool output, and resource links went in. Security-wise this is the important one: MCP servers are classified as OAuth resource servers (RFC 9728) and must honour Resource Indicators (RFC 8707), which is what stops a token issued for one server being replayed at another.
2025-07-31 — MCP publishes a formal governance model:
“Building to Last” introduced a maintainer hierarchy and a SEP proposal process — the machinery a protocol needs before competitors will commit engineering to it. Governance is why MCP revisions arrive on a schedule instead of by announcement.
2025-09-08 — The official MCP Registry opens in preview:
A central metadata repository for public MCP servers — the discovery layer the ecosystem had been faking with README lists. As of September 2026 it is still preview, and the project warns that breaking changes or data resets may occur, so do not build a production dependency on its API shape.
2025-11-25 — MCP 2025-11-25 lands on the protocol’s first anniversary:
Icons, URL-mode elicitation, tool calling during sampling, Client ID Metadata Documents, experimental tasks, JSON Schema 2020-12 as the default dialect, and an SDK tiering system. One year, four revisions — treat the revision string in your client as a compatibility fact, not a footnote.
2025-12-09 — The Agentic AI Foundation forms; Anthropic donates MCP:
AAIF launched as a directed fund under the Linux Foundation with founding projects MCP, goose, and AGENTS.md, and platinum members including AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, and OpenAI. MCP’s maintainers and governance carried on unchanged — the donation transfers the trademark and neutrality, not the roadmap.
2026-07-28 — MCP 2026-07-28: the protocol goes stateless:
The current revision removes the initialize handshake and protocol-level sessions, adds server/discover, replaces server-initiated requests with MRTR, and introduces subscriptions/listen. Roots, sampling, logging, and Dynamic Client Registration are deprecated — deprecated, with removal no earlier than 28 July 2027. A release candidate had been published on 21 May 2026.
2026-08-27 — A2A joins the Agentic AI Foundation:
A2A was accepted as a Growth Stage project in AAIF, putting it under the same neutral roof as MCP, goose, and AGENTS.md. The two halves of the agent protocol stack now share governance — the announcement claims 150-plus supporting organisations, which is endorsement rather than deployment.

Adoption numbers — all self-reported, all dated

At MCP’s one-year mark (December 2025) the project reported over 97 million monthly SDK downloads, about 10,000 active servers, and client support spanning ChatGPT, Claude, Cursor, Gemini, Microsoft Copilot and VS Code. The project’s own 2026-07-28 release post later described SDK downloads as nearing half a billion per month.

Treat every one of those as project self-reported figures, and quote them with their date. The honest summary as of September 2026: the project reports client support spanning ChatGPT, Claude, Cursor, Gemini, Microsoft Copilot and VS Code (self-reported, December 2025), and there are ten official SDKs — Tier 1 TypeScript, Python, C#, Go, Rust; Tier 2 Java, Ruby; Tier 3 Swift, PHP, Kotlin, where tiers reflect feature completeness, protocol support and maintenance commitment. Tier assignments were checked 2026-09-13 and can change.

What the numbers do not tell you: how many of those servers are maintained, reviewed, or safe. A server count is an adoption metric, not a quality metric.

One last piece of the map. Beyond the core protocol, MCP defines optional extensions, negotiated between client and server and “always opt-in” — requiring explicit support from both sides. Three named ones: Tasks (asynchronous execution of long-running operations, moved out of the core protocol into the io.modelcontextprotocol/tasks extension via SEP-2663), MCP Apps (interactive UI elements rendered inline in conversations), and Skills over MCP. Capability objects gained an extensions field in 2026-07-28.

So the mental model to leave with: a deliberately small stateless core, a strict host-mediated trust boundary, and growth pushed to opt-in extensions. That is why the protocol can move this fast without breaking every server at once — and why your own MCP work should record which revision it targets.

Interactive flashcard deck.

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.